@open-mercato/core 0.6.4-develop.4382.1.6b4f656b77 → 0.6.4

package/dist/modules/communication_channels/lib/thread-token.js

@@ -0,0 +1,219 @@
+import { createHash, createHmac, randomBytes, timingSafeEqual } from "crypto";
+import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { ChannelThreadToken } from "../data/entities.js";
+import { isUniqueViolation } from "./pg-errors.js";
+const TOKEN_PREFIX = "om_";
+const RANDOM_BYTES = 16;
+const HMAC_BYTES = 8;
+const HMAC_KEY_ENV = "OM_THREAD_TOKEN_SECRET";
+const HMAC_FALLBACK_KEY_ENV = "KMS_MASTER_KEY";
+const HMAC_KEY_INFO = "thread-token";
+const TOKEN_REGEX = /om_[A-Za-z0-9_-]{22}_[A-Za-z0-9_-]{11}/;
+let cachedKey = null;
+function getKey() {
+  if (cachedKey) return cachedKey;
+  const primary = process.env[HMAC_KEY_ENV];
+  if (primary && primary.length > 0) {
+    cachedKey = Buffer.from(primary, "utf8");
+    return cachedKey;
+  }
+  const fallback = process.env[HMAC_FALLBACK_KEY_ENV];
+  if (fallback && fallback.length > 0) {
+    cachedKey = createHmac("sha256", fallback).update(HMAC_KEY_INFO).digest();
+    return cachedKey;
+  }
+  if (process.env.NODE_ENV === "production") {
+    throw new Error(
+      `[communication_channels] No ${HMAC_KEY_ENV} or ${HMAC_FALLBACK_KEY_ENV} configured \u2014 refusing to sign thread tokens with a static dev key in production.`
+    );
+  }
+  console.warn(
+    `[communication_channels] No ${HMAC_KEY_ENV} or ${HMAC_FALLBACK_KEY_ENV} configured. Thread tokens will use a dev-only static key \u2014 DO NOT USE IN PRODUCTION.`
+  );
+  cachedKey = createHash("sha256").update("open-mercato-thread-token-dev").digest();
+  return cachedKey;
+}
+function _resetThreadTokenKeyCache() {
+  cachedKey = null;
+}
+function base64urlEncode(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function base64urlDecode(value) {
+  if (!/^[A-Za-z0-9_-]+$/.test(value)) return null;
+  const padded = value + "=".repeat((4 - value.length % 4) % 4);
+  try {
+    return Buffer.from(padded.replace(/-/g, "+").replace(/_/g, "/"), "base64");
+  } catch {
+    return null;
+  }
+}
+function computeHmacBytes(random) {
+  return createHmac("sha256", getKey()).update(random).digest().subarray(0, HMAC_BYTES);
+}
+function generateToken() {
+  const random = randomBytes(RANDOM_BYTES);
+  const hmac = computeHmacBytes(random);
+  return `${TOKEN_PREFIX}${base64urlEncode(random)}_${base64urlEncode(hmac)}`;
+}
+const RANDOM_B64_LEN = Math.ceil(RANDOM_BYTES * 4 / 3);
+const HMAC_B64_LEN = Math.ceil(HMAC_BYTES * 4 / 3);
+const TOKEN_TOTAL_LEN = TOKEN_PREFIX.length + RANDOM_B64_LEN + 1 + HMAC_B64_LEN;
+function verifyToken(token) {
+  if (typeof token !== "string") return false;
+  if (token.length !== TOKEN_TOTAL_LEN) return false;
+  if (!token.startsWith(TOKEN_PREFIX)) return false;
+  const randomStart = TOKEN_PREFIX.length;
+  const randomEnd = randomStart + RANDOM_B64_LEN;
+  const separator = token[randomEnd];
+  if (separator !== "_") return false;
+  const hmacStart = randomEnd + 1;
+  const randomPart = token.slice(randomStart, randomEnd);
+  const hmacPart = token.slice(hmacStart, hmacStart + HMAC_B64_LEN);
+  const random = base64urlDecode(randomPart);
+  if (!random || random.length !== RANDOM_BYTES) return false;
+  const provided = base64urlDecode(hmacPart);
+  if (!provided || provided.length !== HMAC_BYTES) return false;
+  const expected = computeHmacBytes(random);
+  try {
+    return timingSafeEqual(provided, expected);
+  } catch {
+    return false;
+  }
+}
+function buildReferencesId(token) {
+  return `<${token}@open-mercato.invalid>`;
+}
+function buildBodyFooter(token) {
+  return {
+    html: `<span style="display:none">[OM:${token}]</span>`,
+    plain: `
+
+[OM:${token}]`
+  };
+}
+function applyOutboundThreadingToken(payload, token) {
+  if (!verifyToken(token)) {
+    throw new Error("applyOutboundThreadingToken: invalid token format/signature");
+  }
+  const refId = buildReferencesId(token);
+  const footer = buildBodyFooter(token);
+  const headers = { ...payload.headers ?? {} };
+  const existingRefs = headers["references"] ?? headers["References"];
+  let nextRefs;
+  if (Array.isArray(existingRefs)) {
+    nextRefs = existingRefs.includes(refId) ? existingRefs.join(" ") : [...existingRefs, refId].join(" ");
+  } else if (typeof existingRefs === "string" && existingRefs.length > 0) {
+    nextRefs = existingRefs.includes(refId) ? existingRefs : `${existingRefs} ${refId}`;
+  } else {
+    nextRefs = refId;
+  }
+  delete headers["references"];
+  headers["References"] = nextRefs;
+  let bodyHtml = payload.bodyHtml;
+  if (typeof bodyHtml === "string") {
+    if (!bodyHtml.includes(`[OM:${token}]`)) {
+      const closing = bodyHtml.lastIndexOf("</body>");
+      if (closing >= 0) {
+        bodyHtml = `${bodyHtml.slice(0, closing)}${footer.html}${bodyHtml.slice(closing)}`;
+      } else {
+        bodyHtml = `${bodyHtml}${footer.html}`;
+      }
+    }
+  }
+  let bodyText = payload.bodyText;
+  if (typeof bodyText === "string") {
+    if (!bodyText.includes(`[OM:${token}]`)) {
+      bodyText = `${bodyText}${footer.plain}`;
+    }
+  }
+  return {
+    ...payload,
+    headers,
+    ...bodyHtml !== void 0 ? { bodyHtml } : {},
+    ...bodyText !== void 0 ? { bodyText } : {}
+  };
+}
+function extractTokenFromHeaders(inReplyTo, references) {
+  const haystack = [];
+  if (typeof inReplyTo === "string" && inReplyTo.length > 0) haystack.push(inReplyTo);
+  if (Array.isArray(references)) haystack.push(...references);
+  else if (typeof references === "string" && references.length > 0) haystack.push(references);
+  for (const candidate of haystack) {
+    const matches = candidate.match(new RegExp(TOKEN_REGEX, "g"));
+    if (!matches) continue;
+    for (const match of matches) {
+      if (verifyToken(match)) return match;
+    }
+  }
+  return null;
+}
+async function getOrCreateThreadToken(em, args) {
+  const dscope = { tenantId: args.tenantId, organizationId: args.organizationId };
+  const existing = await findOneWithDecryption(
+    em,
+    ChannelThreadToken,
+    {
+      tenantId: args.tenantId,
+      organizationId: args.organizationId,
+      messageThreadId: args.messageThreadId
+    },
+    void 0,
+    dscope
+  );
+  if (existing) {
+    return { token: existing.token, created: false };
+  }
+  const row = em.create(ChannelThreadToken, {
+    tenantId: args.tenantId,
+    organizationId: args.organizationId,
+    messageThreadId: args.messageThreadId,
+    token: generateToken()
+  });
+  em.persist(row);
+  try {
+    await em.flush();
+    return { token: row.token, created: true };
+  } catch (err) {
+    if (!isUniqueViolation(err)) throw err;
+    const winner = await findOneWithDecryption(
+      em.fork(),
+      ChannelThreadToken,
+      {
+        tenantId: args.tenantId,
+        organizationId: args.organizationId,
+        messageThreadId: args.messageThreadId
+      },
+      void 0,
+      dscope
+    );
+    if (winner) return { token: winner.token, created: false };
+    throw err;
+  }
+}
+function extractTokenFromBody(bodyHtml, bodyText) {
+  const haystacks = [bodyHtml, bodyText].filter(
+    (value) => typeof value === "string" && value.length > 0
+  );
+  const pattern = new RegExp(`\\[OM:(${TOKEN_REGEX.source})\\]`, "g");
+  for (const haystack of haystacks) {
+    let match;
+    pattern.lastIndex = 0;
+    while ((match = pattern.exec(haystack)) !== null) {
+      if (verifyToken(match[1])) return match[1];
+    }
+  }
+  return null;
+}
+export {
+  _resetThreadTokenKeyCache,
+  applyOutboundThreadingToken,
+  buildBodyFooter,
+  buildReferencesId,
+  extractTokenFromBody,
+  extractTokenFromHeaders,
+  generateToken,
+  getOrCreateThreadToken,
+  verifyToken
+};
+//# sourceMappingURL=thread-token.js.map

package/dist/modules/communication_channels/lib/thread-token.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/communication_channels/lib/thread-token.ts"],
+  "sourcesContent": ["import { createHash, createHmac, randomBytes, timingSafeEqual } from 'crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { ChannelThreadToken } from '../data/entities'\nimport { isUniqueViolation } from './pg-errors'\n\n/**\n * Per-thread crypto token used by the layered thread-matcher to attach\n * inbound replies to the originating Open Mercato message thread, even\n * when the recipient's mail client strips RFC 5322 headers.\n *\n * Token format: `om_<22b64url>_<11b64url>` \u2014 16 random bytes followed by\n * 8 bytes of HMAC-SHA256(random, key), each base64url-encoded without\n * padding. Approximately 37 characters total.\n *\n * Tokens are stored on the `channel_thread_tokens` table keyed by\n * `(tenantId, token)` so that even if the HMAC key leaked, tenant\n * isolation still holds at the DB layer.\n *\n * See `.ai/specs/2026-05-27-email-integration-inbound-reliability-and-threading.md`.\n */\n\nconst TOKEN_PREFIX = 'om_'\nconst RANDOM_BYTES = 16\nconst HMAC_BYTES = 8\nconst HMAC_KEY_ENV = 'OM_THREAD_TOKEN_SECRET'\nconst HMAC_FALLBACK_KEY_ENV = 'KMS_MASTER_KEY'\nconst HMAC_KEY_INFO = 'thread-token'\n\n/**\n * Pre-validated regex for parsing token candidates extracted from headers\n * or body content. Matches our exact format and rejects anything else\n * before HMAC verification \u2014 defense in depth.\n */\nconst TOKEN_REGEX = /om_[A-Za-z0-9_-]{22}_[A-Za-z0-9_-]{11}/\n\nlet cachedKey: Buffer | null = null\n\n/** Resolve the HMAC key. Falls back through env vars per the spec. */\nfunction getKey(): Buffer {\n  if (cachedKey) return cachedKey\n  const primary = process.env[HMAC_KEY_ENV]\n  if (primary && primary.length > 0) {\n    cachedKey = Buffer.from(primary, 'utf8')\n    return cachedKey\n  }\n  const fallback = process.env[HMAC_FALLBACK_KEY_ENV]\n  if (fallback && fallback.length > 0) {\n    // HKDF-style: derive a per-purpose subkey by HMAC-ing the fallback secret\n    // with a constant info label so different purposes don't share a key.\n    cachedKey = createHmac('sha256', fallback).update(HMAC_KEY_INFO).digest()\n    return cachedKey\n  }\n  // No secret configured. Fail closed in production rather than signing thread\n  // tokens with a public static key (which would let anyone forge a thread\n  // token). In non-production we fall back to a dev-only static key and warn.\n  if (process.env.NODE_ENV === 'production') {\n    throw new Error(\n      `[communication_channels] No ${HMAC_KEY_ENV} or ${HMAC_FALLBACK_KEY_ENV} configured \u2014` +\n        ' refusing to sign thread tokens with a static dev key in production.',\n    )\n  }\n  console.warn(\n    `[communication_channels] No ${HMAC_KEY_ENV} or ${HMAC_FALLBACK_KEY_ENV} configured.` +\n      ' Thread tokens will use a dev-only static key \u2014 DO NOT USE IN PRODUCTION.',\n  )\n  cachedKey = createHash('sha256').update('open-mercato-thread-token-dev').digest()\n  return cachedKey\n}\n\n/** Reset the cached key \u2014 for tests that mutate env vars. */\nexport function _resetThreadTokenKeyCache(): void {\n  cachedKey = null\n}\n\nfunction base64urlEncode(buf: Buffer): string {\n  return buf\n    .toString('base64')\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=+$/g, '')\n}\n\nfunction base64urlDecode(value: string): Buffer | null {\n  if (!/^[A-Za-z0-9_-]+$/.test(value)) return null\n  const padded = value + '='.repeat((4 - (value.length % 4)) % 4)\n  try {\n    return Buffer.from(padded.replace(/-/g, '+').replace(/_/g, '/'), 'base64')\n  } catch {\n    return null\n  }\n}\n\nfunction computeHmacBytes(random: Buffer): Buffer {\n  return createHmac('sha256', getKey()).update(random).digest().subarray(0, HMAC_BYTES)\n}\n\n/**\n * Generate a new HMAC-signed thread token. The 16 random bytes make a token\n * collision astronomically unlikely; the `(tenantId, token)` unique constraint\n * is the backstop. Per-thread deduplication (one token per thread) is handled\n * separately by `getOrCreateThreadToken` via the `(tenantId, messageThreadId)`\n * unique constraint \u2014 not here.\n */\nexport function generateToken(): string {\n  const random = randomBytes(RANDOM_BYTES)\n  const hmac = computeHmacBytes(random)\n  return `${TOKEN_PREFIX}${base64urlEncode(random)}_${base64urlEncode(hmac)}`\n}\n\n// Fixed lengths of the base64url-encoded components, without padding.\n// Computed once: 16 bytes -> 22 chars, 8 bytes -> 11 chars.\nconst RANDOM_B64_LEN = Math.ceil((RANDOM_BYTES * 4) / 3)\nconst HMAC_B64_LEN = Math.ceil((HMAC_BYTES * 4) / 3)\nconst TOKEN_TOTAL_LEN = TOKEN_PREFIX.length + RANDOM_B64_LEN + 1 + HMAC_B64_LEN\n\n/**\n * Verify the HMAC signature on a token. Returns `true` only when the\n * structural form is correct AND the HMAC matches under the current key.\n *\n * Does NOT verify the token exists in the DB \u2014 that lookup is the\n * matcher's responsibility (see `thread-matcher.ts`). Verifying here\n * lets us drop forged tokens before any DB I/O.\n *\n * Parsing note: base64url-encoded random/HMAC portions may themselves\n * contain `_` characters, so `split('_')` is unsafe. We parse positionally\n * using the fixed lengths declared above.\n */\nexport function verifyToken(token: string): boolean {\n  if (typeof token !== 'string') return false\n  if (token.length !== TOKEN_TOTAL_LEN) return false\n  if (!token.startsWith(TOKEN_PREFIX)) return false\n  const randomStart = TOKEN_PREFIX.length\n  const randomEnd = randomStart + RANDOM_B64_LEN\n  const separator = token[randomEnd]\n  if (separator !== '_') return false\n  const hmacStart = randomEnd + 1\n  const randomPart = token.slice(randomStart, randomEnd)\n  const hmacPart = token.slice(hmacStart, hmacStart + HMAC_B64_LEN)\n  const random = base64urlDecode(randomPart)\n  if (!random || random.length !== RANDOM_BYTES) return false\n  const provided = base64urlDecode(hmacPart)\n  if (!provided || provided.length !== HMAC_BYTES) return false\n  const expected = computeHmacBytes(random)\n  try {\n    return timingSafeEqual(provided, expected)\n  } catch {\n    return false\n  }\n}\n\n/**\n * Build the synthetic RFC 5322 Message-ID we inject into outbound\n * `References:` headers. Uses the IANA-reserved `.invalid` TLD (RFC 6761\n * \u00A7 3) so RFC-compliant MTAs MUST accept it as syntactically valid.\n */\nexport function buildReferencesId(token: string): string {\n  return `<${token}@open-mercato.invalid>`\n}\n\n/**\n * Build the hidden HTML body span + plain-text trailer used as the\n * token's secondary attachment point (in case `References` is stripped\n * by the recipient's MUA).\n */\nexport function buildBodyFooter(token: string): { html: string; plain: string } {\n  return {\n    html: `<span style=\"display:none\">[OM:${token}]</span>`,\n    plain: `\\n\\n[OM:${token}]`,\n  }\n}\n\n/**\n * Apply the thread token to an outbound MIME-like payload. Mutates the\n * input shape minimally and idempotently:\n *   - `headers.references`: appends the synthetic `<om_TOKEN@\u2026>` id if not\n *     already present (deduped).\n *   - `bodyHtml`: injects a hidden `<span>` before the last `</body>` tag,\n *     or appends if no `</body>` is present.\n *   - `bodyText`: appends the plain-text trailer.\n *\n * Returns a NEW object \u2014 does not mutate the input. Callers that maintain\n * their own MIME structure can call the building blocks directly.\n */\nexport function applyOutboundThreadingToken<\n  T extends {\n    headers?: Record<string, string | string[] | undefined>\n    bodyHtml?: string\n    bodyText?: string\n  },\n>(payload: T, token: string): T {\n  if (!verifyToken(token)) {\n    throw new Error('applyOutboundThreadingToken: invalid token format/signature')\n  }\n  const refId = buildReferencesId(token)\n  const footer = buildBodyFooter(token)\n\n  const headers = { ...(payload.headers ?? {}) } as Record<string, string | string[] | undefined>\n  const existingRefs = headers['references'] ?? headers['References']\n  let nextRefs: string\n  if (Array.isArray(existingRefs)) {\n    nextRefs = existingRefs.includes(refId) ? existingRefs.join(' ') : [...existingRefs, refId].join(' ')\n  } else if (typeof existingRefs === 'string' && existingRefs.length > 0) {\n    nextRefs = existingRefs.includes(refId) ? existingRefs : `${existingRefs} ${refId}`\n  } else {\n    nextRefs = refId\n  }\n  // Normalise to the canonical RFC 5322 header name and drop any duplicate\n  // lowercase entry so the MTA sees a single `References` header.\n  delete headers['references']\n  headers['References'] = nextRefs\n\n  let bodyHtml = payload.bodyHtml\n  if (typeof bodyHtml === 'string') {\n    if (!bodyHtml.includes(`[OM:${token}]`)) {\n      const closing = bodyHtml.lastIndexOf('</body>')\n      if (closing >= 0) {\n        bodyHtml = `${bodyHtml.slice(0, closing)}${footer.html}${bodyHtml.slice(closing)}`\n      } else {\n        bodyHtml = `${bodyHtml}${footer.html}`\n      }\n    }\n  }\n\n  let bodyText = payload.bodyText\n  if (typeof bodyText === 'string') {\n    if (!bodyText.includes(`[OM:${token}]`)) {\n      bodyText = `${bodyText}${footer.plain}`\n    }\n  }\n\n  return {\n    ...payload,\n    headers,\n    ...(bodyHtml !== undefined ? { bodyHtml } : {}),\n    ...(bodyText !== undefined ? { bodyText } : {}),\n  }\n}\n\n/**\n * Extract token candidates from a `References` / `In-Reply-To` header\n * value (string or string[]) and return the FIRST one that HMAC-verifies.\n * Returns `null` if no valid token is present.\n */\nexport function extractTokenFromHeaders(\n  inReplyTo: string | null | undefined,\n  references: string[] | string | null | undefined,\n): string | null {\n  const haystack: string[] = []\n  if (typeof inReplyTo === 'string' && inReplyTo.length > 0) haystack.push(inReplyTo)\n  if (Array.isArray(references)) haystack.push(...references)\n  else if (typeof references === 'string' && references.length > 0) haystack.push(references)\n  for (const candidate of haystack) {\n    const matches = candidate.match(new RegExp(TOKEN_REGEX, 'g'))\n    if (!matches) continue\n    for (const match of matches) {\n      if (verifyToken(match)) return match\n    }\n  }\n  return null\n}\n\n/**\n * Idempotent get-or-create: return the existing `ChannelThreadToken` for the\n * given thread, or create + return a new one. Idempotency is enforced by the\n * `channel_thread_tokens_thread_uq` unique constraint on\n * `(tenant_id, message_thread_id)`: a concurrent double-create loses the race\n * with a unique violation, which we catch and resolve by re-selecting the\n * winner \u2014 so callers always converge on exactly one token per thread.\n *\n * Reads via the standard EntityManager (no encryption needed \u2014 the token\n * column itself is the HMAC-signed value, not encrypted at rest).\n *\n * Use cases:\n *   - Outbound subscriber: get or create a token before injecting it\n *     into the outbound MIME (`applyOutboundThreadingToken`).\n *   - Future \"reset\" UI for tenant admins: explicit rotation by deleting\n *     the row + calling this helper again.\n */\nexport async function getOrCreateThreadToken(\n  em: EntityManager,\n  args: {\n    tenantId: string\n    organizationId: string | null\n    messageThreadId: string\n  },\n): Promise<{ token: string; created: boolean }> {\n  const dscope = { tenantId: args.tenantId, organizationId: args.organizationId }\n  const existing = await findOneWithDecryption(\n    em,\n    ChannelThreadToken,\n    {\n      tenantId: args.tenantId,\n      organizationId: args.organizationId,\n      messageThreadId: args.messageThreadId,\n    },\n    undefined,\n    dscope,\n  )\n  if (existing) {\n    return { token: existing.token, created: false }\n  }\n  const row = em.create(ChannelThreadToken, {\n    tenantId: args.tenantId,\n    organizationId: args.organizationId,\n    messageThreadId: args.messageThreadId,\n    token: generateToken(),\n  })\n  // MikroORM v7 removed `persistAndFlush` \u2014 split into persist + flush.\n  em.persist(row)\n  try {\n    await em.flush()\n    return { token: row.token, created: true }\n  } catch (err) {\n    // A concurrent create for the same (tenant, thread) won the race; the\n    // unique constraint rejected ours. Re-select the winner on a clean fork so\n    // we never return a half-persisted row or surface a spurious error.\n    if (!isUniqueViolation(err)) throw err\n    const winner = await findOneWithDecryption(\n      em.fork(),\n      ChannelThreadToken,\n      {\n        tenantId: args.tenantId,\n        organizationId: args.organizationId,\n        messageThreadId: args.messageThreadId,\n      },\n      undefined,\n      dscope,\n    )\n    if (winner) return { token: winner.token, created: false }\n    throw err\n  }\n}\n\n/**\n * Extract a token candidate from an inbound body (HTML or plain text).\n * Scans for `[OM:om_\u2026]` markers and returns the first that HMAC-verifies.\n */\nexport function extractTokenFromBody(\n  bodyHtml: string | null | undefined,\n  bodyText: string | null | undefined,\n): string | null {\n  const haystacks = [bodyHtml, bodyText].filter(\n    (value): value is string => typeof value === 'string' && value.length > 0,\n  )\n  const pattern = new RegExp(`\\\\[OM:(${TOKEN_REGEX.source})\\\\]`, 'g')\n  for (const haystack of haystacks) {\n    let match: RegExpExecArray | null\n    pattern.lastIndex = 0\n    while ((match = pattern.exec(haystack)) !== null) {\n      if (verifyToken(match[1])) return match[1]\n    }\n  }\n  return null\n}\n"],
+  "mappings": "AAAA,SAAS,YAAY,YAAY,aAAa,uBAAuB;AAErE,SAAS,6BAA6B;AACtC,SAAS,0BAA0B;AACnC,SAAS,yBAAyB;AAkBlC,MAAM,eAAe;AACrB,MAAM,eAAe;AACrB,MAAM,aAAa;AACnB,MAAM,eAAe;AACrB,MAAM,wBAAwB;AAC9B,MAAM,gBAAgB;AAOtB,MAAM,cAAc;AAEpB,IAAI,YAA2B;AAG/B,SAAS,SAAiB;AACxB,MAAI,UAAW,QAAO;AACtB,QAAM,UAAU,QAAQ,IAAI,YAAY;AACxC,MAAI,WAAW,QAAQ,SAAS,GAAG;AACjC,gBAAY,OAAO,KAAK,SAAS,MAAM;AACvC,WAAO;AAAA,EACT;AACA,QAAM,WAAW,QAAQ,IAAI,qBAAqB;AAClD,MAAI,YAAY,SAAS,SAAS,GAAG;AAGnC,gBAAY,WAAW,UAAU,QAAQ,EAAE,OAAO,aAAa,EAAE,OAAO;AACxE,WAAO;AAAA,EACT;AAIA,MAAI,QAAQ,IAAI,aAAa,cAAc;AACzC,UAAM,IAAI;AAAA,MACR,+BAA+B,YAAY,OAAO,qBAAqB;AAAA,IAEzE;AAAA,EACF;AACA,UAAQ;AAAA,IACN,+BAA+B,YAAY,OAAO,qBAAqB;AAAA,EAEzE;AACA,cAAY,WAAW,QAAQ,EAAE,OAAO,+BAA+B,EAAE,OAAO;AAChF,SAAO;AACT;AAGO,SAAS,4BAAkC;AAChD,cAAY;AACd;AAEA,SAAS,gBAAgB,KAAqB;AAC5C,SAAO,IACJ,SAAS,QAAQ,EACjB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,QAAQ,EAAE;AACvB;AAEA,SAAS,gBAAgB,OAA8B;AACrD,MAAI,CAAC,mBAAmB,KAAK,KAAK,EAAG,QAAO;AAC5C,QAAM,SAAS,QAAQ,IAAI,QAAQ,IAAK,MAAM,SAAS,KAAM,CAAC;AAC9D,MAAI;AACF,WAAO,OAAO,KAAK,OAAO,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,GAAG,QAAQ;AAAA,EAC3E,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,iBAAiB,QAAwB;AAChD,SAAO,WAAW,UAAU,OAAO,CAAC,EAAE,OAAO,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,UAAU;AACtF;AASO,SAAS,gBAAwB;AACtC,QAAM,SAAS,YAAY,YAAY;AACvC,QAAM,OAAO,iBAAiB,MAAM;AACpC,SAAO,GAAG,YAAY,GAAG,gBAAgB,MAAM,CAAC,IAAI,gBAAgB,IAAI,CAAC;AAC3E;AAIA,MAAM,iBAAiB,KAAK,KAAM,eAAe,IAAK,CAAC;AACvD,MAAM,eAAe,KAAK,KAAM,aAAa,IAAK,CAAC;AACnD,MAAM,kBAAkB,aAAa,SAAS,iBAAiB,IAAI;AAc5D,SAAS,YAAY,OAAwB;AAClD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,MAAM,WAAW,gBAAiB,QAAO;AAC7C,MAAI,CAAC,MAAM,WAAW,YAAY,EAAG,QAAO;AAC5C,QAAM,cAAc,aAAa;AACjC,QAAM,YAAY,cAAc;AAChC,QAAM,YAAY,MAAM,SAAS;AACjC,MAAI,cAAc,IAAK,QAAO;AAC9B,QAAM,YAAY,YAAY;AAC9B,QAAM,aAAa,MAAM,MAAM,aAAa,SAAS;AACrD,QAAM,WAAW,MAAM,MAAM,WAAW,YAAY,YAAY;AAChE,QAAM,SAAS,gBAAgB,UAAU;AACzC,MAAI,CAAC,UAAU,OAAO,WAAW,aAAc,QAAO;AACtD,QAAM,WAAW,gBAAgB,QAAQ;AACzC,MAAI,CAAC,YAAY,SAAS,WAAW,WAAY,QAAO;AACxD,QAAM,WAAW,iBAAiB,MAAM;AACxC,MAAI;AACF,WAAO,gBAAgB,UAAU,QAAQ;AAAA,EAC3C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOO,SAAS,kBAAkB,OAAuB;AACvD,SAAO,IAAI,KAAK;AAClB;AAOO,SAAS,gBAAgB,OAAgD;AAC9E,SAAO;AAAA,IACL,MAAM,kCAAkC,KAAK;AAAA,IAC7C,OAAO;AAAA;AAAA,MAAW,KAAK;AAAA,EACzB;AACF;AAcO,SAAS,4BAMd,SAAY,OAAkB;AAC9B,MAAI,CAAC,YAAY,KAAK,GAAG;AACvB,UAAM,IAAI,MAAM,6DAA6D;AAAA,EAC/E;AACA,QAAM,QAAQ,kBAAkB,KAAK;AACrC,QAAM,SAAS,gBAAgB,KAAK;AAEpC,QAAM,UAAU,EAAE,GAAI,QAAQ,WAAW,CAAC,EAAG;AAC7C,QAAM,eAAe,QAAQ,YAAY,KAAK,QAAQ,YAAY;AAClE,MAAI;AACJ,MAAI,MAAM,QAAQ,YAAY,GAAG;AAC/B,eAAW,aAAa,SAAS,KAAK,IAAI,aAAa,KAAK,GAAG,IAAI,CAAC,GAAG,cAAc,KAAK,EAAE,KAAK,GAAG;AAAA,EACtG,WAAW,OAAO,iBAAiB,YAAY,aAAa,SAAS,GAAG;AACtE,eAAW,aAAa,SAAS,KAAK,IAAI,eAAe,GAAG,YAAY,IAAI,KAAK;AAAA,EACnF,OAAO;AACL,eAAW;AAAA,EACb;AAGA,SAAO,QAAQ,YAAY;AAC3B,UAAQ,YAAY,IAAI;AAExB,MAAI,WAAW,QAAQ;AACvB,MAAI,OAAO,aAAa,UAAU;AAChC,QAAI,CAAC,SAAS,SAAS,OAAO,KAAK,GAAG,GAAG;AACvC,YAAM,UAAU,SAAS,YAAY,SAAS;AAC9C,UAAI,WAAW,GAAG;AAChB,mBAAW,GAAG,SAAS,MAAM,GAAG,OAAO,CAAC,GAAG,OAAO,IAAI,GAAG,SAAS,MAAM,OAAO,CAAC;AAAA,MAClF,OAAO;AACL,mBAAW,GAAG,QAAQ,GAAG,OAAO,IAAI;AAAA,MACtC;AAAA,IACF;AAAA,EACF;AAEA,MAAI,WAAW,QAAQ;AACvB,MAAI,OAAO,aAAa,UAAU;AAChC,QAAI,CAAC,SAAS,SAAS,OAAO,KAAK,GAAG,GAAG;AACvC,iBAAW,GAAG,QAAQ,GAAG,OAAO,KAAK;AAAA,IACvC;AAAA,EACF;AAEA,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC;AAAA,IAC7C,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC;AAAA,EAC/C;AACF;AAOO,SAAS,wBACd,WACA,YACe;AACf,QAAM,WAAqB,CAAC;AAC5B,MAAI,OAAO,cAAc,YAAY,UAAU,SAAS,EAAG,UAAS,KAAK,SAAS;AAClF,MAAI,MAAM,QAAQ,UAAU,EAAG,UAAS,KAAK,GAAG,UAAU;AAAA,WACjD,OAAO,eAAe,YAAY,WAAW,SAAS,EAAG,UAAS,KAAK,UAAU;AAC1F,aAAW,aAAa,UAAU;AAChC,UAAM,UAAU,UAAU,MAAM,IAAI,OAAO,aAAa,GAAG,CAAC;AAC5D,QAAI,CAAC,QAAS;AACd,eAAW,SAAS,SAAS;AAC3B,UAAI,YAAY,KAAK,EAAG,QAAO;AAAA,IACjC;AAAA,EACF;AACA,SAAO;AACT;AAmBA,eAAsB,uBACpB,IACA,MAK8C;AAC9C,QAAM,SAAS,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,eAAe;AAC9E,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,MACE,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,iBAAiB,KAAK;AAAA,IACxB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,UAAU;AACZ,WAAO,EAAE,OAAO,SAAS,OAAO,SAAS,MAAM;AAAA,EACjD;AACA,QAAM,MAAM,GAAG,OAAO,oBAAoB;AAAA,IACxC,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,iBAAiB,KAAK;AAAA,IACtB,OAAO,cAAc;AAAA,EACvB,CAAC;AAED,KAAG,QAAQ,GAAG;AACd,MAAI;AACF,UAAM,GAAG,MAAM;AACf,WAAO,EAAE,OAAO,IAAI,OAAO,SAAS,KAAK;AAAA,EAC3C,SAAS,KAAK;AAIZ,QAAI,CAAC,kBAAkB,GAAG,EAAG,OAAM;AACnC,UAAM,SAAS,MAAM;AAAA,MACnB,GAAG,KAAK;AAAA,MACR;AAAA,MACA;AAAA,QACE,UAAU,KAAK;AAAA,QACf,gBAAgB,KAAK;AAAA,QACrB,iBAAiB,KAAK;AAAA,MACxB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,OAAQ,QAAO,EAAE,OAAO,OAAO,OAAO,SAAS,MAAM;AACzD,UAAM;AAAA,EACR;AACF;AAMO,SAAS,qBACd,UACA,UACe;AACf,QAAM,YAAY,CAAC,UAAU,QAAQ,EAAE;AAAA,IACrC,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS;AAAA,EAC1E;AACA,QAAM,UAAU,IAAI,OAAO,UAAU,YAAY,MAAM,QAAQ,GAAG;AAClE,aAAW,YAAY,WAAW;AAChC,QAAI;AACJ,YAAQ,YAAY;AACpB,YAAQ,QAAQ,QAAQ,KAAK,QAAQ,OAAO,MAAM;AAChD,UAAI,YAAY,MAAM,CAAC,CAAC,EAAG,QAAO,MAAM,CAAC;AAAA,IAC3C;AAAA,EACF;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/modules/communication_channels/lib/use-connect-channel.js

@@ -0,0 +1,61 @@
+"use client";
+import * as React from "react";
+import { useT } from "@open-mercato/shared/lib/i18n/context";
+import { flash } from "@open-mercato/ui/backend/FlashMessages";
+import { useGuardedMutation } from "@open-mercato/ui/backend/injection/useGuardedMutation";
+import { apiCall } from "@open-mercato/ui/backend/utils/apiCall";
+function useConnectChannel(options) {
+  const { providerKey } = options;
+  const returnUrl = options.returnUrl ?? "/backend/profile/communication-channels";
+  const t = useT();
+  const [pending, setPending] = React.useState(false);
+  const { runMutation, retryLastMutation } = useGuardedMutation({
+    contextId: `channel-${providerKey}-connect`,
+    blockedMessage: t("communication_channels.profile.connect.blocked", "Connection blocked by validation")
+  });
+  const mutationContext = React.useMemo(
+    () => ({ providerKey, retryLastMutation }),
+    [providerKey, retryLastMutation]
+  );
+  const connect = React.useCallback(async () => {
+    if (pending) return;
+    setPending(true);
+    try {
+      const response = await runMutation({
+        context: mutationContext,
+        mutationPayload: { providerKey },
+        operation: () => apiCall(`/api/communication_channels/oauth/${providerKey}/initiate`, {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ returnUrl })
+        })
+      });
+      const body = response.result;
+      if (!response.ok || !body?.authorizeUrl) {
+        if (body?.code === "oauth_client_not_configured") {
+          flash(
+            t(
+              "communication_channels.profile.connect.notConfigured",
+              "This provider is not configured yet. Ask an administrator to add the OAuth Client ID and Secret under Integrations before connecting a mailbox."
+            ),
+            "error"
+          );
+          return;
+        }
+        flash(
+          body?.error ?? t("communication_channels.profile.connect.oauthFailed", "Could not start OAuth connection."),
+          "error"
+        );
+        return;
+      }
+      window.location.assign(body.authorizeUrl);
+    } finally {
+      setPending(false);
+    }
+  }, [mutationContext, pending, providerKey, returnUrl, runMutation, t]);
+  return { connect, pending };
+}
+export {
+  useConnectChannel
+};
+//# sourceMappingURL=use-connect-channel.js.map

package/dist/modules/communication_channels/lib/use-connect-channel.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/communication_channels/lib/use-connect-channel.ts"],
+  "sourcesContent": ["'use client'\n\nimport * as React from 'react'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\n\ntype InitiateResponse = { authorizeUrl?: string; error?: string; code?: string }\n\n/**\n * Shared OAuth \"connect\" flow for email channel provider widgets (Gmail and\n * other OAuth providers). Wraps the guarded-mutation contract + `/oauth/<provider>/initiate`\n * call + redirect, so each provider widget only supplies its own button chrome.\n */\nexport function useConnectChannel(options: {\n  providerKey: string\n  returnUrl?: string\n}): { connect: () => Promise<void>; pending: boolean } {\n  const { providerKey } = options\n  const returnUrl = options.returnUrl ?? '/backend/profile/communication-channels'\n  const t = useT()\n  const [pending, setPending] = React.useState(false)\n  const { runMutation, retryLastMutation } = useGuardedMutation({\n    contextId: `channel-${providerKey}-connect`,\n    blockedMessage: t('communication_channels.profile.connect.blocked', 'Connection blocked by validation'),\n  })\n  const mutationContext = React.useMemo(\n    () => ({ providerKey, retryLastMutation }),\n    [providerKey, retryLastMutation],\n  )\n\n  const connect = React.useCallback(async () => {\n    if (pending) return\n    setPending(true)\n    try {\n      const response = await runMutation({\n        context: mutationContext,\n        mutationPayload: { providerKey },\n        operation: () =>\n          apiCall<InitiateResponse>(`/api/communication_channels/oauth/${providerKey}/initiate`, {\n            method: 'POST',\n            headers: { 'content-type': 'application/json' },\n            body: JSON.stringify({ returnUrl }),\n          }),\n      })\n      const body = response.result as InitiateResponse | undefined\n      if (!response.ok || !body?.authorizeUrl) {\n        if (body?.code === 'oauth_client_not_configured') {\n          flash(\n            t(\n              'communication_channels.profile.connect.notConfigured',\n              'This provider is not configured yet. Ask an administrator to add the OAuth Client ID and Secret under Integrations before connecting a mailbox.',\n            ),\n            'error',\n          )\n          return\n        }\n        flash(\n          body?.error ??\n            t('communication_channels.profile.connect.oauthFailed', 'Could not start OAuth connection.'),\n          'error',\n        )\n        return\n      }\n      window.location.assign(body.authorizeUrl)\n    } finally {\n      setPending(false)\n    }\n  }, [mutationContext, pending, providerKey, returnUrl, runMutation, t])\n\n  return { connect, pending }\n}\n"],
+  "mappings": ";AAEA,YAAY,WAAW;AACvB,SAAS,YAAY;AACrB,SAAS,aAAa;AACtB,SAAS,0BAA0B;AACnC,SAAS,eAAe;AASjB,SAAS,kBAAkB,SAGqB;AACrD,QAAM,EAAE,YAAY,IAAI;AACxB,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAS,KAAK;AAClD,QAAM,EAAE,aAAa,kBAAkB,IAAI,mBAAmB;AAAA,IAC5D,WAAW,WAAW,WAAW;AAAA,IACjC,gBAAgB,EAAE,kDAAkD,kCAAkC;AAAA,EACxG,CAAC;AACD,QAAM,kBAAkB,MAAM;AAAA,IAC5B,OAAO,EAAE,aAAa,kBAAkB;AAAA,IACxC,CAAC,aAAa,iBAAiB;AAAA,EACjC;AAEA,QAAM,UAAU,MAAM,YAAY,YAAY;AAC5C,QAAI,QAAS;AACb,eAAW,IAAI;AACf,QAAI;AACF,YAAM,WAAW,MAAM,YAAY;AAAA,QACjC,SAAS;AAAA,QACT,iBAAiB,EAAE,YAAY;AAAA,QAC/B,WAAW,MACT,QAA0B,qCAAqC,WAAW,aAAa;AAAA,UACrF,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,UAC9C,MAAM,KAAK,UAAU,EAAE,UAAU,CAAC;AAAA,QACpC,CAAC;AAAA,MACL,CAAC;AACD,YAAM,OAAO,SAAS;AACtB,UAAI,CAAC,SAAS,MAAM,CAAC,MAAM,cAAc;AACvC,YAAI,MAAM,SAAS,+BAA+B;AAChD;AAAA,YACE;AAAA,cACE;AAAA,cACA;AAAA,YACF;AAAA,YACA;AAAA,UACF;AACA;AAAA,QACF;AACA;AAAA,UACE,MAAM,SACJ,EAAE,sDAAsD,mCAAmC;AAAA,UAC7F;AAAA,QACF;AACA;AAAA,MACF;AACA,aAAO,SAAS,OAAO,KAAK,YAAY;AAAA,IAC1C,UAAE;AACA,iBAAW,KAAK;AAAA,IAClB;AAAA,EACF,GAAG,CAAC,iBAAiB,SAAS,aAAa,WAAW,aAAa,CAAC,CAAC;AAErE,SAAO,EAAE,SAAS,QAAQ;AAC5B;",
+  "names": []
+}

package/dist/modules/communication_channels/migrations/Migration20260526134719_communication_channels.js

@@ -0,0 +1,50 @@
+import { Migration } from "@mikro-orm/migrations";
+class Migration20260526134719_communication_channels extends Migration {
+  up() {
+    this.addSql(`create table "channel_thread_mappings" ("id" uuid not null default gen_random_uuid(), "external_conversation_id" uuid not null, "message_thread_id" uuid not null, "channel_id" uuid not null, "provider_key" text not null, "external_thread_ref" text not null, "assigned_user_id" uuid null, "tenant_id" uuid not null, "organization_id" uuid null, "created_at" timestamptz not null, "updated_at" timestamptz not null, primary key ("id"));`);
+    this.addSql(`create index "channel_thread_mappings_thread_idx" on "channel_thread_mappings" ("message_thread_id", "tenant_id");`);
+    this.addSql(`create index "channel_thread_mappings_ext_conv_idx" on "channel_thread_mappings" ("external_conversation_id", "tenant_id");`);
+    this.addSql(`alter table "channel_thread_mappings" add constraint "channel_thread_mappings_ext_conv_uq" unique ("external_conversation_id", "tenant_id");`);
+    this.addSql(`create table "communication_channels" ("id" uuid not null default gen_random_uuid(), "provider_key" text not null, "channel_type" text not null, "display_name" text not null, "external_identifier" text null, "credentials_ref" uuid null, "capabilities" jsonb null, "is_active" boolean not null default true, "user_id" uuid null, "is_primary" boolean not null default false, "poll_interval_seconds" int null, "last_polled_at" timestamptz null, "status" text not null default 'connected', "last_error" text null, "channel_state" jsonb null, "tenant_id" uuid not null, "organization_id" uuid null, "created_at" timestamptz not null, "updated_at" timestamptz not null, "deleted_at" timestamptz null, primary key ("id"));`);
+    this.addSql(`create index "communication_channels_tenant_type_active_idx" on "communication_channels" ("tenant_id", "channel_type", "is_active");`);
+    this.addSql(`create index "communication_channels_tenant_provider_idx" on "communication_channels" ("tenant_id", "provider_key");`);
+    this.addSql(`create unique index "communication_channels_one_primary_per_user_uq" on "communication_channels" ("user_id") where "is_primary" and "user_id" is not null and "deleted_at" is null;`);
+    this.addSql(`create index "communication_channels_poll_due_idx" on "communication_channels" ("is_active", "last_polled_at") where "deleted_at" is null;`);
+    this.addSql(`create index "communication_channels_user_lookup_idx" on "communication_channels" ("user_id", "channel_type", "deleted_at");`);
+    this.addSql(`create table "external_conversations" ("id" uuid not null default gen_random_uuid(), "channel_id" uuid not null, "external_conversation_id" text not null, "subject" text null, "contact_person_id" uuid null, "assigned_user_id" uuid null, "last_message_at" timestamptz null, "tenant_id" uuid not null, "organization_id" uuid null, "created_at" timestamptz not null, "updated_at" timestamptz not null, primary key ("id"));`);
+    this.addSql(`create index "external_conversations_assigned_user_idx" on "external_conversations" ("assigned_user_id");`);
+    this.addSql(`create index "external_conversations_contact_person_idx" on "external_conversations" ("contact_person_id");`);
+    this.addSql(`create index "external_conversations_channel_idx" on "external_conversations" ("channel_id", "external_conversation_id");`);
+    this.addSql(`alter table "external_conversations" add constraint "external_conversations_channel_external_uq" unique ("channel_id", "external_conversation_id");`);
+    this.addSql(`create table "external_messages" ("id" uuid not null default gen_random_uuid(), "channel_id" uuid not null, "conversation_id" uuid not null, "external_message_id" text not null, "direction" text not null, "sender_identifier" text null, "sender_display_name" text null, "provider_timestamp" timestamptz null, "tenant_id" uuid not null, "organization_id" uuid null, "created_at" timestamptz not null, primary key ("id"));`);
+    this.addSql(`create index "external_messages_channel_external_idx" on "external_messages" ("channel_id", "external_message_id");`);
+    this.addSql(`create index "external_messages_conversation_idx" on "external_messages" ("conversation_id");`);
+    this.addSql(`alter table "external_messages" add constraint "external_messages_channel_external_uq" unique ("channel_id", "external_message_id");`);
+    this.addSql(`create table "message_channel_links" ("id" uuid not null default gen_random_uuid(), "message_id" uuid not null, "external_conversation_id" uuid not null, "external_message_id" uuid null, "provider_key" text not null, "channel_type" text not null, "direction" text not null, "delivery_status" text not null default 'pending', "channel_payload" jsonb null, "channel_content_type" text null, "interactive_state" jsonb null, "channel_metadata" jsonb null, "tenant_id" uuid not null, "organization_id" uuid null, "created_at" timestamptz not null, primary key ("id"));`);
+    this.addSql(`create index "message_channel_links_ext_msg_idx" on "message_channel_links" ("external_message_id");`);
+    this.addSql(`create index "message_channel_links_ext_conv_idx" on "message_channel_links" ("external_conversation_id");`);
+    this.addSql(`create index "message_channel_links_message_idx" on "message_channel_links" ("message_id");`);
+    this.addSql(`alter table "message_channel_links" add constraint "message_channel_links_message_uq" unique ("message_id");`);
+    this.addSql(`create table "message_reactions" ("id" uuid not null default gen_random_uuid(), "message_id" uuid not null, "emoji" text not null, "reacted_by_user_id" uuid null, "reacted_by_external_id" text null, "reacted_by_display_name" text null, "provider_key" text null, "external_reaction_id" text null, "tenant_id" uuid not null, "organization_id" uuid null, "created_at" timestamptz not null, primary key ("id"));`);
+    this.addSql(`alter table "message_reactions" add constraint "message_reactions_exactly_one_actor_chk" check (("reacted_by_user_id" is null) <> ("reacted_by_external_id" is null));`);
+    this.addSql(`create index "message_reactions_message_emoji_idx" on "message_reactions" ("message_id", "emoji");`);
+    this.addSql(`create index "message_reactions_message_idx" on "message_reactions" ("message_id");`);
+    this.addSql(`create unique index "message_reactions_external_actor_uq" on "message_reactions" ("tenant_id", "message_id", "emoji", "reacted_by_external_id") where "reacted_by_external_id" is not null;`);
+    this.addSql(`create unique index "message_reactions_internal_actor_uq" on "message_reactions" ("tenant_id", "message_id", "emoji", "reacted_by_user_id") where "reacted_by_user_id" is not null;`);
+  }
+  down() {
+    this.addSql(`drop table if exists "message_reactions";`);
+    this.addSql(`drop table if exists "message_channel_links";`);
+    this.addSql(`drop table if exists "external_messages";`);
+    this.addSql(`drop table if exists "external_conversations";`);
+    this.addSql(`drop index if exists "communication_channels_user_lookup_idx";`);
+    this.addSql(`drop index if exists "communication_channels_poll_due_idx";`);
+    this.addSql(`drop index if exists "communication_channels_one_primary_per_user_uq";`);
+    this.addSql(`drop table if exists "communication_channels";`);
+    this.addSql(`drop table if exists "channel_thread_mappings";`);
+  }
+}
+export {
+  Migration20260526134719_communication_channels
+};
+//# sourceMappingURL=Migration20260526134719_communication_channels.js.map

package/dist/modules/communication_channels/migrations/Migration20260526134719_communication_channels.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/communication_channels/migrations/Migration20260526134719_communication_channels.ts"],
+  "sourcesContent": ["import { Migration } from '@mikro-orm/migrations';\n\nexport class Migration20260526134719_communication_channels extends Migration {\n\n  override up(): void | Promise<void> {\n    this.addSql(`create table \"channel_thread_mappings\" (\"id\" uuid not null default gen_random_uuid(), \"external_conversation_id\" uuid not null, \"message_thread_id\" uuid not null, \"channel_id\" uuid not null, \"provider_key\" text not null, \"external_thread_ref\" text not null, \"assigned_user_id\" uuid null, \"tenant_id\" uuid not null, \"organization_id\" uuid null, \"created_at\" timestamptz not null, \"updated_at\" timestamptz not null, primary key (\"id\"));`);\n    this.addSql(`create index \"channel_thread_mappings_thread_idx\" on \"channel_thread_mappings\" (\"message_thread_id\", \"tenant_id\");`);\n    this.addSql(`create index \"channel_thread_mappings_ext_conv_idx\" on \"channel_thread_mappings\" (\"external_conversation_id\", \"tenant_id\");`);\n    this.addSql(`alter table \"channel_thread_mappings\" add constraint \"channel_thread_mappings_ext_conv_uq\" unique (\"external_conversation_id\", \"tenant_id\");`);\n\n    this.addSql(`create table \"communication_channels\" (\"id\" uuid not null default gen_random_uuid(), \"provider_key\" text not null, \"channel_type\" text not null, \"display_name\" text not null, \"external_identifier\" text null, \"credentials_ref\" uuid null, \"capabilities\" jsonb null, \"is_active\" boolean not null default true, \"user_id\" uuid null, \"is_primary\" boolean not null default false, \"poll_interval_seconds\" int null, \"last_polled_at\" timestamptz null, \"status\" text not null default 'connected', \"last_error\" text null, \"channel_state\" jsonb null, \"tenant_id\" uuid not null, \"organization_id\" uuid null, \"created_at\" timestamptz not null, \"updated_at\" timestamptz not null, \"deleted_at\" timestamptz null, primary key (\"id\"));`);\n    this.addSql(`create index \"communication_channels_tenant_type_active_idx\" on \"communication_channels\" (\"tenant_id\", \"channel_type\", \"is_active\");`);\n    this.addSql(`create index \"communication_channels_tenant_provider_idx\" on \"communication_channels\" (\"tenant_id\", \"provider_key\");`);\n    this.addSql(`create unique index \"communication_channels_one_primary_per_user_uq\" on \"communication_channels\" (\"user_id\") where \"is_primary\" and \"user_id\" is not null and \"deleted_at\" is null;`);\n    this.addSql(`create index \"communication_channels_poll_due_idx\" on \"communication_channels\" (\"is_active\", \"last_polled_at\") where \"deleted_at\" is null;`);\n    this.addSql(`create index \"communication_channels_user_lookup_idx\" on \"communication_channels\" (\"user_id\", \"channel_type\", \"deleted_at\");`);\n\n    this.addSql(`create table \"external_conversations\" (\"id\" uuid not null default gen_random_uuid(), \"channel_id\" uuid not null, \"external_conversation_id\" text not null, \"subject\" text null, \"contact_person_id\" uuid null, \"assigned_user_id\" uuid null, \"last_message_at\" timestamptz null, \"tenant_id\" uuid not null, \"organization_id\" uuid null, \"created_at\" timestamptz not null, \"updated_at\" timestamptz not null, primary key (\"id\"));`);\n    this.addSql(`create index \"external_conversations_assigned_user_idx\" on \"external_conversations\" (\"assigned_user_id\");`);\n    this.addSql(`create index \"external_conversations_contact_person_idx\" on \"external_conversations\" (\"contact_person_id\");`);\n    this.addSql(`create index \"external_conversations_channel_idx\" on \"external_conversations\" (\"channel_id\", \"external_conversation_id\");`);\n    this.addSql(`alter table \"external_conversations\" add constraint \"external_conversations_channel_external_uq\" unique (\"channel_id\", \"external_conversation_id\");`);\n\n    this.addSql(`create table \"external_messages\" (\"id\" uuid not null default gen_random_uuid(), \"channel_id\" uuid not null, \"conversation_id\" uuid not null, \"external_message_id\" text not null, \"direction\" text not null, \"sender_identifier\" text null, \"sender_display_name\" text null, \"provider_timestamp\" timestamptz null, \"tenant_id\" uuid not null, \"organization_id\" uuid null, \"created_at\" timestamptz not null, primary key (\"id\"));`);\n    this.addSql(`create index \"external_messages_channel_external_idx\" on \"external_messages\" (\"channel_id\", \"external_message_id\");`);\n    this.addSql(`create index \"external_messages_conversation_idx\" on \"external_messages\" (\"conversation_id\");`);\n    this.addSql(`alter table \"external_messages\" add constraint \"external_messages_channel_external_uq\" unique (\"channel_id\", \"external_message_id\");`);\n\n    this.addSql(`create table \"message_channel_links\" (\"id\" uuid not null default gen_random_uuid(), \"message_id\" uuid not null, \"external_conversation_id\" uuid not null, \"external_message_id\" uuid null, \"provider_key\" text not null, \"channel_type\" text not null, \"direction\" text not null, \"delivery_status\" text not null default 'pending', \"channel_payload\" jsonb null, \"channel_content_type\" text null, \"interactive_state\" jsonb null, \"channel_metadata\" jsonb null, \"tenant_id\" uuid not null, \"organization_id\" uuid null, \"created_at\" timestamptz not null, primary key (\"id\"));`);\n    this.addSql(`create index \"message_channel_links_ext_msg_idx\" on \"message_channel_links\" (\"external_message_id\");`);\n    this.addSql(`create index \"message_channel_links_ext_conv_idx\" on \"message_channel_links\" (\"external_conversation_id\");`);\n    this.addSql(`create index \"message_channel_links_message_idx\" on \"message_channel_links\" (\"message_id\");`);\n    this.addSql(`alter table \"message_channel_links\" add constraint \"message_channel_links_message_uq\" unique (\"message_id\");`);\n\n    this.addSql(`create table \"message_reactions\" (\"id\" uuid not null default gen_random_uuid(), \"message_id\" uuid not null, \"emoji\" text not null, \"reacted_by_user_id\" uuid null, \"reacted_by_external_id\" text null, \"reacted_by_display_name\" text null, \"provider_key\" text null, \"external_reaction_id\" text null, \"tenant_id\" uuid not null, \"organization_id\" uuid null, \"created_at\" timestamptz not null, primary key (\"id\"));`);\n    this.addSql(`alter table \"message_reactions\" add constraint \"message_reactions_exactly_one_actor_chk\" check ((\"reacted_by_user_id\" is null) <> (\"reacted_by_external_id\" is null));`);\n    this.addSql(`create index \"message_reactions_message_emoji_idx\" on \"message_reactions\" (\"message_id\", \"emoji\");`);\n    this.addSql(`create index \"message_reactions_message_idx\" on \"message_reactions\" (\"message_id\");`);\n    this.addSql(`create unique index \"message_reactions_external_actor_uq\" on \"message_reactions\" (\"tenant_id\", \"message_id\", \"emoji\", \"reacted_by_external_id\") where \"reacted_by_external_id\" is not null;`);\n    this.addSql(`create unique index \"message_reactions_internal_actor_uq\" on \"message_reactions\" (\"tenant_id\", \"message_id\", \"emoji\", \"reacted_by_user_id\") where \"reacted_by_user_id\" is not null;`);\n  }\n\n  override down(): void | Promise<void> {\n    this.addSql(`drop table if exists \"message_reactions\";`);\n    this.addSql(`drop table if exists \"message_channel_links\";`);\n    this.addSql(`drop table if exists \"external_messages\";`);\n    this.addSql(`drop table if exists \"external_conversations\";`);\n    this.addSql(`drop index if exists \"communication_channels_user_lookup_idx\";`);\n    this.addSql(`drop index if exists \"communication_channels_poll_due_idx\";`);\n    this.addSql(`drop index if exists \"communication_channels_one_primary_per_user_uq\";`);\n    this.addSql(`drop table if exists \"communication_channels\";`);\n    this.addSql(`drop table if exists \"channel_thread_mappings\";`);\n  }\n\n}\n"],
+  "mappings": "AAAA,SAAS,iBAAiB;AAEnB,MAAM,uDAAuD,UAAU;AAAA,EAEnE,KAA2B;AAClC,SAAK,OAAO,obAAob;AAChc,SAAK,OAAO,oHAAoH;AAChI,SAAK,OAAO,6HAA6H;AACzI,SAAK,OAAO,8IAA8I;AAE1J,SAAK,OAAO,6sBAA6sB;AACztB,SAAK,OAAO,sIAAsI;AAClJ,SAAK,OAAO,sHAAsH;AAClI,SAAK,OAAO,qLAAqL;AACjM,SAAK,OAAO,4IAA4I;AACxJ,SAAK,OAAO,8HAA8H;AAE1I,SAAK,OAAO,qaAAqa;AACjb,SAAK,OAAO,2GAA2G;AACvH,SAAK,OAAO,6GAA6G;AACzH,SAAK,OAAO,2HAA2H;AACvI,SAAK,OAAO,qJAAqJ;AAEjK,SAAK,OAAO,qaAAqa;AACjb,SAAK,OAAO,qHAAqH;AACjI,SAAK,OAAO,+FAA+F;AAC3G,SAAK,OAAO,sIAAsI;AAElJ,SAAK,OAAO,qjBAAqjB;AACjkB,SAAK,OAAO,sGAAsG;AAClH,SAAK,OAAO,4GAA4G;AACxH,SAAK,OAAO,6FAA6F;AACzG,SAAK,OAAO,8GAA8G;AAE1H,SAAK,OAAO,yZAAyZ;AACra,SAAK,OAAO,wKAAwK;AACpL,SAAK,OAAO,oGAAoG;AAChH,SAAK,OAAO,qFAAqF;AACjG,SAAK,OAAO,6LAA6L;AACzM,SAAK,OAAO,qLAAqL;AAAA,EACnM;AAAA,EAES,OAA6B;AACpC,SAAK,OAAO,2CAA2C;AACvD,SAAK,OAAO,+CAA+C;AAC3D,SAAK,OAAO,2CAA2C;AACvD,SAAK,OAAO,gDAAgD;AAC5D,SAAK,OAAO,gEAAgE;AAC5E,SAAK,OAAO,6DAA6D;AACzE,SAAK,OAAO,wEAAwE;AACpF,SAAK,OAAO,gDAAgD;AAC5D,SAAK,OAAO,iDAAiD;AAAA,EAC/D;AAEF;",
+  "names": []
+}

package/dist/modules/communication_channels/migrations/Migration20260527195446_communication_channels.js

@@ -0,0 +1,19 @@
+import { Migration } from "@mikro-orm/migrations";
+class Migration20260527195446_communication_channels extends Migration {
+  up() {
+    this.addSql(`create table "channel_ingest_dead_letters" ("id" uuid not null default gen_random_uuid(), "tenant_id" uuid not null, "organization_id" uuid null, "channel_id" uuid not null, "provider_key" text not null, "external_uid" text null, "external_message_id" text null, "error_class" text not null, "error_message" text not null, "raw_body" text null, "created_at" timestamptz not null, primary key ("id"));`);
+    this.addSql(`create index "channel_ingest_dead_letters_created_idx" on "channel_ingest_dead_letters" ("tenant_id", "created_at");`);
+    this.addSql(`create index "channel_ingest_dead_letters_channel_idx" on "channel_ingest_dead_letters" ("channel_id", "tenant_id");`);
+    this.addSql(`create table "channel_thread_tokens" ("id" uuid not null default gen_random_uuid(), "tenant_id" uuid not null, "organization_id" uuid null, "message_thread_id" uuid not null, "token" text not null, "created_at" timestamptz not null, "last_seen_at" timestamptz null, primary key ("id"));`);
+    this.addSql(`create index "channel_thread_tokens_thread_idx" on "channel_thread_tokens" ("message_thread_id", "tenant_id");`);
+    this.addSql(`alter table "channel_thread_tokens" add constraint "channel_thread_tokens_token_uq" unique ("tenant_id", "token");`);
+  }
+  down() {
+    this.addSql(`drop table if exists "channel_ingest_dead_letters";`);
+    this.addSql(`drop table if exists "channel_thread_tokens";`);
+  }
+}
+export {
+  Migration20260527195446_communication_channels
+};
+//# sourceMappingURL=Migration20260527195446_communication_channels.js.map

package/dist/modules/communication_channels/migrations/Migration20260527195446_communication_channels.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/communication_channels/migrations/Migration20260527195446_communication_channels.ts"],
+  "sourcesContent": ["import { Migration } from '@mikro-orm/migrations';\n\nexport class Migration20260527195446_communication_channels extends Migration {\n\n  override up(): void | Promise<void> {\n    this.addSql(`create table \"channel_ingest_dead_letters\" (\"id\" uuid not null default gen_random_uuid(), \"tenant_id\" uuid not null, \"organization_id\" uuid null, \"channel_id\" uuid not null, \"provider_key\" text not null, \"external_uid\" text null, \"external_message_id\" text null, \"error_class\" text not null, \"error_message\" text not null, \"raw_body\" text null, \"created_at\" timestamptz not null, primary key (\"id\"));`);\n    this.addSql(`create index \"channel_ingest_dead_letters_created_idx\" on \"channel_ingest_dead_letters\" (\"tenant_id\", \"created_at\");`);\n    this.addSql(`create index \"channel_ingest_dead_letters_channel_idx\" on \"channel_ingest_dead_letters\" (\"channel_id\", \"tenant_id\");`);\n\n    this.addSql(`create table \"channel_thread_tokens\" (\"id\" uuid not null default gen_random_uuid(), \"tenant_id\" uuid not null, \"organization_id\" uuid null, \"message_thread_id\" uuid not null, \"token\" text not null, \"created_at\" timestamptz not null, \"last_seen_at\" timestamptz null, primary key (\"id\"));`);\n    this.addSql(`create index \"channel_thread_tokens_thread_idx\" on \"channel_thread_tokens\" (\"message_thread_id\", \"tenant_id\");`);\n    this.addSql(`alter table \"channel_thread_tokens\" add constraint \"channel_thread_tokens_token_uq\" unique (\"tenant_id\", \"token\");`);\n  }\n\n  override down(): void | Promise<void> {\n    this.addSql(`drop table if exists \"channel_ingest_dead_letters\";`);\n    this.addSql(`drop table if exists \"channel_thread_tokens\";`);\n  }\n\n}\n"],
+  "mappings": "AAAA,SAAS,iBAAiB;AAEnB,MAAM,uDAAuD,UAAU;AAAA,EAEnE,KAA2B;AAClC,SAAK,OAAO,kZAAkZ;AAC9Z,SAAK,OAAO,sHAAsH;AAClI,SAAK,OAAO,sHAAsH;AAElI,SAAK,OAAO,gSAAgS;AAC5S,SAAK,OAAO,gHAAgH;AAC5H,SAAK,OAAO,oHAAoH;AAAA,EAClI;AAAA,EAES,OAA6B;AACpC,SAAK,OAAO,qDAAqD;AACjE,SAAK,OAAO,+CAA+C;AAAA,EAC7D;AAEF;",
+  "names": []
+}

package/dist/modules/communication_channels/migrations/Migration20260529231848_communication_channels.js

@@ -0,0 +1,13 @@
+import { Migration } from "@mikro-orm/migrations";
+class Migration20260529231848_communication_channels extends Migration {
+  up() {
+    this.addSql(`create index "communication_channels_provider_external_idx" on "communication_channels" ("provider_key", "external_identifier") where "deleted_at" is null;`);
+  }
+  down() {
+    this.addSql(`drop index "communication_channels_provider_external_idx";`);
+  }
+}
+export {
+  Migration20260529231848_communication_channels
+};
+//# sourceMappingURL=Migration20260529231848_communication_channels.js.map

package/dist/modules/communication_channels/migrations/Migration20260529231848_communication_channels.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/communication_channels/migrations/Migration20260529231848_communication_channels.ts"],
+  "sourcesContent": ["import { Migration } from '@mikro-orm/migrations';\n\nexport class Migration20260529231848_communication_channels extends Migration {\n\n  override up(): void | Promise<void> {\n    this.addSql(`create index \"communication_channels_provider_external_idx\" on \"communication_channels\" (\"provider_key\", \"external_identifier\") where \"deleted_at\" is null;`);\n  }\n\n  override down(): void | Promise<void> {\n    this.addSql(`drop index \"communication_channels_provider_external_idx\";`);\n  }\n\n}\n"],
+  "mappings": "AAAA,SAAS,iBAAiB;AAEnB,MAAM,uDAAuD,UAAU;AAAA,EAEnE,KAA2B;AAClC,SAAK,OAAO,6JAA6J;AAAA,EAC3K;AAAA,EAES,OAA6B;AACpC,SAAK,OAAO,4DAA4D;AAAA,EAC1E;AAEF;",
+  "names": []
+}

package/dist/modules/communication_channels/migrations/Migration20260531120000_communication_channels.js

@@ -0,0 +1,17 @@
+import { Migration } from "@mikro-orm/migrations";
+class Migration20260531120000_communication_channels extends Migration {
+  up() {
+    this.addSql(`drop index if exists "channel_thread_tokens_thread_idx";`);
+    this.addSql(`alter table "channel_thread_tokens" add constraint "channel_thread_tokens_thread_uq" unique ("tenant_id", "message_thread_id");`);
+    this.addSql(`create unique index "communication_channels_user_provider_external_uq" on "communication_channels" ("tenant_id", "user_id", "provider_key", "external_identifier") where "deleted_at" is null and "user_id" is not null and "external_identifier" is not null;`);
+  }
+  down() {
+    this.addSql(`drop index if exists "communication_channels_user_provider_external_uq";`);
+    this.addSql(`alter table "channel_thread_tokens" drop constraint if exists "channel_thread_tokens_thread_uq";`);
+    this.addSql(`create index "channel_thread_tokens_thread_idx" on "channel_thread_tokens" ("message_thread_id", "tenant_id");`);
+  }
+}
+export {
+  Migration20260531120000_communication_channels
+};
+//# sourceMappingURL=Migration20260531120000_communication_channels.js.map

package/dist/modules/communication_channels/migrations/Migration20260531120000_communication_channels.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/communication_channels/migrations/Migration20260531120000_communication_channels.ts"],
+  "sourcesContent": ["import { Migration } from '@mikro-orm/migrations';\n\nexport class Migration20260531120000_communication_channels extends Migration {\n\n  override up(): void | Promise<void> {\n    // Enforce one thread token per (tenant, message_thread_id). Replaces the\n    // earlier non-unique `channel_thread_tokens_thread_idx` so `getOrCreateThreadToken`\n    // is idempotent under concurrency (insert-on-conflict). The new unique index\n    // also serves the `WHERE tenant_id = ? AND message_thread_id = ?` lookup.\n    this.addSql(`drop index if exists \"channel_thread_tokens_thread_idx\";`);\n    this.addSql(`alter table \"channel_thread_tokens\" add constraint \"channel_thread_tokens_thread_uq\" unique (\"tenant_id\", \"message_thread_id\");`);\n    // Enforce one channel per (tenant, user, provider, mailbox) so a reconnect\n    // heals the existing row instead of inserting a duplicate. Partial: tenant-wide\n    // (null user_id) and identifier-less channels are exempt.\n    this.addSql(`create unique index \"communication_channels_user_provider_external_uq\" on \"communication_channels\" (\"tenant_id\", \"user_id\", \"provider_key\", \"external_identifier\") where \"deleted_at\" is null and \"user_id\" is not null and \"external_identifier\" is not null;`);\n  }\n\n  override down(): void | Promise<void> {\n    this.addSql(`drop index if exists \"communication_channels_user_provider_external_uq\";`);\n    this.addSql(`alter table \"channel_thread_tokens\" drop constraint if exists \"channel_thread_tokens_thread_uq\";`);\n    this.addSql(`create index \"channel_thread_tokens_thread_idx\" on \"channel_thread_tokens\" (\"message_thread_id\", \"tenant_id\");`);\n  }\n\n}\n"],
+  "mappings": "AAAA,SAAS,iBAAiB;AAEnB,MAAM,uDAAuD,UAAU;AAAA,EAEnE,KAA2B;AAKlC,SAAK,OAAO,0DAA0D;AACtE,SAAK,OAAO,iIAAiI;AAI7I,SAAK,OAAO,gQAAgQ;AAAA,EAC9Q;AAAA,EAES,OAA6B;AACpC,SAAK,OAAO,0EAA0E;AACtF,SAAK,OAAO,kGAAkG;AAC9G,SAAK,OAAO,gHAAgH;AAAA,EAC9H;AAEF;",
+  "names": []
+}

package/dist/modules/communication_channels/notifications.client.js

@@ -0,0 +1,51 @@
+"use client";
+import { MessageReceivedRenderer } from "./widgets/notifications/MessageReceivedRenderer.js";
+import { ChannelRequiresReauthRenderer } from "./widgets/notifications/ChannelRequiresReauthRenderer.js";
+const communicationChannelsNotificationTypes = [
+  {
+    type: "communication_channels.message.received",
+    module: "communication_channels",
+    titleKey: "communication_channels.notifications.message_received.title",
+    bodyKey: "communication_channels.notifications.message_received.body",
+    icon: "message-circle",
+    severity: "info",
+    actions: [
+      {
+        id: "view",
+        labelKey: "common.view",
+        variant: "outline",
+        href: "/backend/messages/{sourceEntityId}",
+        icon: "external-link"
+      }
+    ],
+    linkHref: "/backend/messages/{sourceEntityId}",
+    Renderer: MessageReceivedRenderer,
+    expiresAfterHours: 168
+  },
+  {
+    type: "communication_channels.channel.requires_reauth",
+    module: "communication_channels",
+    titleKey: "communication_channels.notifications.channel_requires_reauth.title",
+    bodyKey: "communication_channels.notifications.channel_requires_reauth.body",
+    icon: "alert-triangle",
+    severity: "warning",
+    actions: [
+      {
+        id: "reconnect",
+        labelKey: "communication_channels.notifications.channel_requires_reauth.reconnect",
+        variant: "outline",
+        href: "/backend/profile/communication-channels?reconnect={sourceEntityId}",
+        icon: "refresh-cw"
+      }
+    ],
+    linkHref: "/backend/profile/communication-channels?reconnect={sourceEntityId}",
+    Renderer: ChannelRequiresReauthRenderer,
+    expiresAfterHours: 720
+  }
+];
+var notifications_client_default = communicationChannelsNotificationTypes;
+export {
+  communicationChannelsNotificationTypes,
+  notifications_client_default as default
+};
+//# sourceMappingURL=notifications.client.js.map

package/dist/modules/communication_channels/notifications.client.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/modules/communication_channels/notifications.client.ts"],
+  "sourcesContent": ["'use client'\n\nimport type { NotificationTypeDefinition } from '@open-mercato/shared/modules/notifications/types'\nimport { MessageReceivedRenderer } from './widgets/notifications/MessageReceivedRenderer'\nimport { ChannelRequiresReauthRenderer } from './widgets/notifications/ChannelRequiresReauthRenderer'\n\nexport const communicationChannelsNotificationTypes: NotificationTypeDefinition[] = [\n  {\n    type: 'communication_channels.message.received',\n    module: 'communication_channels',\n    titleKey: 'communication_channels.notifications.message_received.title',\n    bodyKey: 'communication_channels.notifications.message_received.body',\n    icon: 'message-circle',\n    severity: 'info',\n    actions: [\n      {\n        id: 'view',\n        labelKey: 'common.view',\n        variant: 'outline',\n        href: '/backend/messages/{sourceEntityId}',\n        icon: 'external-link',\n      },\n    ],\n    linkHref: '/backend/messages/{sourceEntityId}',\n    Renderer: MessageReceivedRenderer,\n    expiresAfterHours: 168,\n  },\n  {\n    type: 'communication_channels.channel.requires_reauth',\n    module: 'communication_channels',\n    titleKey: 'communication_channels.notifications.channel_requires_reauth.title',\n    bodyKey: 'communication_channels.notifications.channel_requires_reauth.body',\n    icon: 'alert-triangle',\n    severity: 'warning',\n    actions: [\n      {\n        id: 'reconnect',\n        labelKey: 'communication_channels.notifications.channel_requires_reauth.reconnect',\n        variant: 'outline',\n        href: '/backend/profile/communication-channels?reconnect={sourceEntityId}',\n        icon: 'refresh-cw',\n      },\n    ],\n    linkHref: '/backend/profile/communication-channels?reconnect={sourceEntityId}',\n    Renderer: ChannelRequiresReauthRenderer,\n    expiresAfterHours: 720,\n  },\n]\n\nexport default communicationChannelsNotificationTypes\n"],
+  "mappings": ";AAGA,SAAS,+BAA+B;AACxC,SAAS,qCAAqC;AAEvC,MAAM,yCAAuE;AAAA,EAClF;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS;AAAA,IACT,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,MACP;AAAA,QACE,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SAAS;AAAA,QACT,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,UAAU;AAAA,IACV,UAAU;AAAA,IACV,mBAAmB;AAAA,EACrB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS;AAAA,IACT,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,MACP;AAAA,QACE,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SAAS;AAAA,QACT,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,UAAU;AAAA,IACV,UAAU;AAAA,IACV,mBAAmB;AAAA,EACrB;AACF;AAEA,IAAO,+BAAQ;",
+  "names": []
+}